N.Y. Comp. Codes R. & Regs. tit. 10, § 66-1.2 – Statewide immunization registry.

(1) Statewide immunization information system shall mean the statewide (except New York City) computerized database of immunizations developed and maintained by the New York State Department of Health, known as the New York State Immunization Information System ("NYSIIS" or "system").
(2) Citywide immunization registry (CIR) shall mean the immunization information system maintained by the New York City Department of Health and Mental Hygiene, capable of collecting, storing and disclosing the electronic and paper records of vaccinations administered to persons less than 19 years of age and those persons 19 and older with consent in accordance with the New York City Health Code. For the purposes of this definition, the term New York City Department of Health and Mental Hygiene shall mean such agency or any successor agency responsible for the CIR.
(3) Health care provider for the purposes of this section shall mean any person authorized by law to order an immunization or any health care facility licensed under article 28 of the Public Health Law or any certified home health agency established under section 3606 of the Public Health Law.
(4) Designees shall mean individuals, acting under the authority of a health care provider or another category of authorized user, who have been specifically delegated responsibility to access NYSIIS or the CIR and perform the functions permitted the primary authorized user.
(5) Emancipated minors shall mean those children less than 18 years of age who by virtue of a court decision declaring them emancipated, or who because they are otherwise emancipated under the law, are able to make their own decisions regarding health care services.
(6) Registrants shall mean all individuals for whom an immunization or exemption to immunization or blood lead analysis is recorded in the system, at any time following January 1, 2008 for NYSIIS and January 1, 1994 for the CIR. Registrants also include individuals born in New York State (outside of New York City) on or after January 1, 2004 for NYSIIS or born in New York City on or after January 1, 1996 for the CIR.
(7) School, for the purposes of this section, shall mean any agency or entity required by law or regulation to verify immunization status for participants prior to or at selected times during enrollment, including licensed day care facilities. Such verification is an authorized delegation of public health authority for the purposes of fulfilling this public health mandate related to verification of immunization status.
(8) Authorized users of NYSIIS and the CIR shall mean the following categories of users, who are permitted access only to records of registrants falling within their administrative or clinical responsibilities. An authorized user in a category below may designate the ability to access the system to others where indicated:
1. (i) health care providers who order an immunization, and their designees, including Regional Health Information Organizations or other Health Information Technology entities as defined in 18 NYCRR section 504.9(h)(2);
2. (ii) local health districts;
3. (iii) commissioners of local social services districts and their designees;
4. (iv) the commissioner of the Office of Children and Family Services and his/her designees;
5. (v) schools;
6. (vi) third party payers;
7. (vii) WIC programs;
8. (viii) colleges;
9. (ix) professional and technical schools;
10. (x) children’s overnight camps and summer day camps;
11. (xi) registered professional nurses; and
12. (xii) pharmacists authorized to administer immunizations pursuant to subdivision (2) of section 6801 of the Education Law.
  (b) Mandated reporting.
(1) Mandated reporters to NYSIIS and the CIR include any health care provider, as defined in this section, who administers an immunization or conducts a blood lead analysis of a sample.
(2) Mandated reporters must report any immunization to a child less than 19 years of age to either NYSIIS or the CIR, depending on the location of administration of the vaccine.
(3) Article 28 facilities or certified home health agencies established under section 3606 of the Public Health Law in which providers are responsible for administration of vaccines may, when agreed to by the facility and the provider ordering the vaccination, assume reporting responsibility for the authorized individuals administering vaccines within their facilities.
(4) A person who administers but does not order immunizations is not responsible for reporting the immunizations to the system, unless acting as a designee of the health care provider who ordered the immunization and under whose supervision the vaccine was administered. The ordering health care provider remains responsible for supervising his/her designee and ensuring that appropriate and timely reporting occurs.
(5) When vaccines are administered based on non-patient specific orders, the health care provider ordering the immunizations shall ensure that required data elements for each vaccination are submitted to NYSIIS or the CIR, depending on the location of administration of the vaccine.
(c) Information required to be reported, methods of reporting, exceptions and timeliness of reporting.
(1) Information required to be reported to NYSIIS or the CIR, to the extent available to the provider shall include: the patient’s name (first, middle and last); date of birth; gender; race; ethnicity; address, including zip code; telephone numbers; birth order (if multiple birth); birth state/country; mother’s maiden name; mother’s or other responsible party’s name (first, middle and last); vaccines for children program eligibility; Medicaid number; and vaccine administration date, type, lot number and manufacturer, except as noted in paragraph (3) of this subdivision. A provider should report elements for any additional data fields in NYSIIS or the CIR when available.
(2) Methods of reporting. All data elements reported to NYSIIS or the CIR must be submitted electronically except as provided in paragraph (3) of this subdivision.
1. (i) Direct online entry of immunization information into NYSIIS. Authorized users with read/write access and their designees may submit information directly to the statewide system using their individual access accounts.
2. (ii) Health care providers with existing electronic information systems compatible with NYSIIS. Such providers may request, on an individual or group basis, permission to download information from current systems into a department-prescribed file format for transfer directly to NYSIIS. The provider is responsible for the costs/programming needed to effect these data transfers, ensuring that transfers are completed on a timely basis and updating provider-specific data systems when changes are made to these systems.
3. (iii) Historical immunization information previously submitted to a regional registry. Health care providers who have submitted immunization records to one of the regional immunization registries (Healthy Shot or Immunization Registry and Information Source [“IRIS”]) may authorize submission of this regionally-archived immunization history information to the statewide system.
4. (iv) Submission of immunization information to NYSIIS or the CIR. Providers must submit immunization information to NYSIIS or the CIR, dependent upon the IIS operating in the area in which they practice, not the IIS appropriate to the patient’s area of residence. Exchange of information between IIS’s will be the responsibility of NYSIIS and the CIR.
(3) Exceptions to reporting requirements to NYSIIS.
1. (i) Hospitals participating in the statewide perinatal data system are exempted from entering immunization information directly into NYSIIS for newborns during their initial hospital stay. Information submitted through the statewide perinatal data system will populate NYSIIS’s required information fields. Hospitals located in New York State, outside of New York City, are required to report to NYSIIS all other immunizations administered to children less than 19 years of age while under their care.
2. (ii) A provider may submit incomplete immunization electronic files or may manually enter incomplete immunization information into the statewide system in fulfillment of requirements for submission of historical immunization information. Required information for immunizations administered after January 1, 2008, which is missing shall be entered when it becomes available to the provider.
(4) Timeliness of reporting. Providers ordering immunizations must submit immunization information to NYSIIS or the CIR within 14 days of administration of the immunization. Providers must also submit information regarding immunizations not previously reported for each registrant. For NYSIIS only:
1. (i) Providers must submit any missing information requested by NYSIIS within 14 days of the issuance of the request.
2. (ii) For individuals exempt from administration of vaccines, providers must submit patient information, including the reason that such immunization may be detrimental to the child’s health, as defined in section 66-1.1(l) of this Subpart, to the statewide immunization information system within 14 days following the in-person clinical interaction that occurs at or after what would normally have been the due date for administration of an age-appropriate immunization to that child, according to current national immunization recommendations.
  (d) Allowable access levels and permitted uses of NYSIIS and/or CIR data by authorized users specific to the organization they are representing.
(1) Allowable access levels.
1. (i) Read/write access. Only health care providers providing services to the registrant and State and local Department of Health staff may compile reports, read immunization information, enter immunization information and change immunization information, with limitations as specified below. Health care providers who have been granted a time-limited deferral on electronic data submission to NYSIIS may access the information by phone or via written request.
2. (ii) Read-only access. Authorized users not listed in subparagraph (i) of this paragraph (such as schools) are permitted read-only access to NYSIIS and/or the CIR. Read-only access allows the user to view records of only those children under their administrative responsibility and to compile reports based on data aggregated from those records.
(2) Permitted uses of NYSIIS or CIR data. All requests for use of NYSIIS information by an authorized user which are not included in the allowable uses for that person as noted in subparagraphs (i)-(x) of this paragraph are prohibited without the approval of the commissioner of the State Department of Health; or, for requests for CIR information, without the approval of the commissioner of the New York City Department of Health and Mental Hygiene or his or her designee. Approval is contingent on ongoing adherence to the terms and conditions of the user agreements. Allowable uses of the data for particular categories of users include:
1. (i) Health care providers or their designees may access NYSIIS or CIR data for the provision of care and treatment, either temporary or longer term, to a particular registrant. The information can be used either on a patient-specific basis or to generate reports specific to their practice to determine immunizations received by a specific group of registrants, review of practice coverage, generation of reminder and recall notices, quality improvement, vaccine inventory and accountability inclusive of Vaccines for Children (VFC) Program inventory and accountability, vaccine ordering, VFC re-enrollment, and printing a copy of the immunization record for the registrant or the registrant’s parent or guardian, as appropriate.
  1. (a) If other child health status or test results information becomes available through NYSIIS or the CIR that may be useful in determining the course of treatment for the child, such information will be made available on an as-needed and authorized basis to health care providers.
2. (ii) Schools may access NYSIIS or CIR data for verifying immunization history for students entering or registered in that school or school system or may run school-specific reports that aggregate available data. Access will be limited to data for registrants enrolling or already enrolled in a particular school or school system.
3. (iii) Commissioners of local social services districts and their designees may access NYSIIS or CIR data with regard to children in their legal custody. Such information may be used for quality assurance and accountability by local social services districts.
4. (iv) The commissioner of the Office of Children and Family Services and his/her designees may access NYSIIS or CIR data with regard to children in his/her legal custody. Such information may be used for ensuring appropriate care and treatment of children for whom the Office of Children and Family Services maintains custody and responsibility.
5. (v) Local health departments may access immunization data in NYSIIS and the CIR for purposes of outreach, quality improvement and vaccine accountability, epidemiological studies and disease control within their own county. Local health department staff may be granted access to immunization information in NYSIIS and the CIR for registrants whose immunizations were administered within their own county and for registrants residing in the county whose immunizations were administered outside of the county.
6. (vi) Third party payers may access NYSIIS or CIR data for the purpose of performing quality assurance, accountability and outreach relating to enrollees covered by their plan. Third party payers must request information from the appropriate registries.
7. (vii) The Commissioner of Health and the commissioner of the New York City Department of Health and Mental Hygiene and their designated staffs will have full read/write access to their respective systems/registries in order to fulfill file maintenance and improvement functions and may use the data in both NYSIIS and the CIR for purposes of outreach, quality improvement and vaccine accountability, research, epidemiological studies and disease control.
  1. (a) The Commissioner of Health or the Commissioner of the New York City Department of Health and Mental Hygiene or his or her designee may provide, on request, registrant-specific information to other State or city immunization systems and systems maintained by the Indian Health Service and tribal nations recognized by the State or the United States on a routine basis pursuant to a written agreement with each system requiring such system to conform to national standards for maintaining the integrity of the data, protecting the confidentiality of personal information and using the data only for purposes permitted in this section.
  2. (b) The Commissioner of Health or the Commissioner of the New York City Department of Health and Mental Hygiene may provide registrant-specific information to Federal health officials, State or city immunization systems and systems maintained by the Indian Health Service and tribal nations recognized by the State or the United States and others identified by the commissioner of each respective immunization information system, for activities necessary to protect public health, in accordance with any written agreement required by such commissioner.
  3. (c) The Commissioner of Health or the Commissioner of the New York City Department of Health and Mental Hygiene may provide institutes of higher education, medical research centers or other institutions engaged in epidemiological research or other public health research access to de-identified registrant information in NYSIIS or the CIR for research purposes if approved by the Commissioner of Health or the Commissioner of the New York City Department of Health and Mental Hygiene, as appropriate.
8. (viii) WIC programs for the purposes of verifying immunization and lead testing status for those seeking or receiving services, as well as referral for immunizations or lead tests as needed.
9. (ix) Colleges may access NYSIIS or CIR data for verifying immunization history for students entering or registered in that college or college system or may run college-specific reports that aggregate available data. Access shall be limited to data for registrants enrolling or already enrolled in a particular college or college system.
10. (x) Professional and technical schools may access NYSIIS or CIR data for verifying immunization history for students entering or registered in that professional or technical school or may run college-specific reports that aggregate available data. Access shall be limited to data for registrants enrolling or already enrolled in a particular professional or technical school.
11. (xi) Children’s overnight camps and summer day camps may access NYSIIS or CIR data for verifying immunization history for children attending that overnight camp or summer day camp or may run camp-specific reports that aggregate available data. Access shall be limited to data for registrants attending a particular overnight or summer day camp.
12. (xii) Any parent or guardian of a registrant less than 18 years of age or the registrant himself/herself if 18 years or older or an emancipated minor, may receive a copy of an immunization record at no cost from their local health department, the CIR or NYSIIS.
  (e) Methods of accessing immunization data.
  Each person seeking access to NYSIIS and/or the CIR must submit a completed application for access.
  (f) Maintenance of security and confidentiality.
(1) Each person accessing the statewide system must have a distinct password and system ID that conform to industry standards, and with level and type of access tied to the type of user, as defined in subdivision (d) of this section.
(2) Each person must understand and agree to adhere to the confidentiality protocol developed by the department or the NYCDOHMH prior to either submitting or obtaining data from NYSIIS or the CIR.
(g) Provision of NYSIIS information to registrant’s family/guardian.
(1) Mandated reporters to NYSIIS must provide the parent or legal guardian of each registrant with a copy of an informational brochure or letter from the department at the time of each registrant’s initial entry into the statewide system by that provider.
(2) If the parent/guardian speaks a primary language other than English, mandated reporters to NYSIIS must make every attempt to provide statewide system-related information comparable to the department’s brochure in the primary language of the parent or guardian.

(a) Definitions.